The easiest way to install an SSL certificate is to enable the free SSL your web host already offers. Log in to your hosting panel, open the SSL or Security section, pick your domain, and turn on free SSL or AutoSSL. It issues in minutes, and most hosts renew it for you automatically.
Before you touch any settings, it helps to know how people actually get a certificate. If you want the full background on what these certificates do, read what an SSL certificate is first. Otherwise, here are your four routes, from easiest to most involved.
| Option | Cost | Best for | Effort |
|---|---|---|---|
| Free SSL included by your host | Free | Almost everyone (most common) | Lowest — a few clicks |
| Free Let's Encrypt via your panel | Free | Hosts that expose a Let's Encrypt tool | Low |
| Free via Cloudflare (edge certificate) | Free | Sites already using or adding Cloudflare | Low to medium |
| Paid certificate from a Certificate Authority | Paid | Businesses needing OV/EV validation | Higher |
A Certificate Authority (CA) is the trusted organization that issues and signs certificates so browsers accept them. Free options like Let's Encrypt are issued by a CA too, so they are just as secure as paid ones for encryption. The main reason to pay is a higher validation level, which we cover in method 4.
This is the route we recommend for most readers. Nearly every modern host includes free SSL and turns on AutoSSL, a feature that issues and renews the certificate automatically. Follow these steps in your hosting panel (hPanel on Hostinger, or cPanel on many other hosts).
hPanel or cPanel.AutoSSL.That is it. Once the status reads Active, your domain can load over HTTPS. You still need to force HTTPS so visitors always use it, which we cover below.
Let's Encrypt is a free, automated Certificate Authority trusted by every major browser. Many hosts expose it directly through a tool in the panel, so you rarely have to touch the command line.
Let's Encrypt or AutoSSL tool.Let's Encrypt certificates last 90 days by design, but the panel tool renews them automatically well before they expire. You do not have to renew by hand as long as the tool stays enabled.
Cloudflare sits in front of your site and can provide a free edge certificate, which secures the connection between your visitors and Cloudflare's network. This is a good fit if you already use Cloudflare or want its speed and protection features.
Full.Full, not Flexible. Flexible leaves the link between Cloudflare and your server unencrypted, which can cause redirect loops and weaker security. For the strongest setup, install a certificate on your host too and use Full (strict).Most sites do not need this. You would choose a paid certificate when you want Organization Validation (OV) or Extended Validation (EV), where the CA verifies that a real business is behind the domain. Large stores and financial or corporate sites sometimes prefer this extra layer of vetting.
CSR.The encryption strength is the same as a free certificate. You are paying for the validation level and support, not stronger security. If you only need the padlock and HTTPS, a free option does the job.
Installing a certificate does not automatically move visitors to the secure address. Someone can still open the old http:// version. To fix that, you force HTTPS, which redirects all HTTP traffic to HTTPS. Pick whichever of these matches your setup.
Force HTTPS option right next to the SSL settings. Turn it on and you are done..htaccess file so every request is sent to the HTTPS version.Site Address and WordPress Address to your https:// URL, then use a redirect plugin to catch anything left over. New to WordPress? Our guide to installing WordPress walks through the dashboard.Finally, update your internal links so they point to the HTTPS version. Old links that still use http:// can trigger warnings, which brings us to the next step.
Once HTTPS is forced, confirm everything is healthy:
When the padlock shows, the SSL checker passes, and there are no mixed content warnings, your site is fully on HTTPS.
http:// and https://, visitors land on the insecure version, and you get none of the trust or ranking benefit. Always turn on force HTTPS after installing.Enable the free SSL your host already includes, use a Let's Encrypt tool in your hosting panel, or add your site to Cloudflare for a free edge certificate. All three are trusted by browsers and cost nothing. For most sites, the host's built-in free SSL is the quickest route.
First enable free SSL in your hosting panel. Then in WordPress, open Settings > General and set both the Site Address and WordPress Address to your https:// URL. Add a redirect plugin to force HTTPS, then fix any mixed content warnings so every page loads securely.
Yes, certificates expire, but you usually do not have to renew them by hand. Host-provided SSL, AutoSSL, and Let's Encrypt panel tools renew automatically before the expiry date. Only manually installed certificates need a manual renewal, so confirm auto-renewal is switched on.
Yes. Let's Encrypt is a widely trusted, non-profit Certificate Authority recognized by every major browser. Its certificates use the same encryption strength as paid ones. The only practical difference is that it offers domain validation, not the organization or extended validation that some businesses want.
Use your host's one-click Force HTTPS toggle if it has one. On Apache, add a redirect rule to your .htaccess file. On WordPress, set your site URLs to https:// and use a redirect plugin. Then update internal links so nothing points to the old HTTP address.
For encryption, yes. A free certificate and a paid one protect the connection identically and both show the padlock. Paid certificates add a higher validation level, where the Certificate Authority verifies your organization. That vetting is the difference, not the security of the encrypted connection.
Usually one of two reasons: you have not forced HTTPS, so the page still loads over HTTP, or the page has mixed content pulling in insecure files. Turn on force HTTPS, then find and fix the HTTP resources. The padlock returns once every element loads securely.
Getting your site onto HTTPS comes down to four steps: pick a source for the certificate, install it, force HTTPS site-wide, and verify the padlock. For most people the whole job takes minutes because their host offers free SSL that installs and renews on its own. Only reach for a paid certificate when you genuinely need organization or extended validation. Once you are secure, tie up the loose ends by working through our website security guide to harden the rest of your site.
If you are setting up a new site and want to skip the manual steps entirely, the simplest route is a host that provisions and auto-renews a free SSL certificate for you, so it never expires and you never have to install anything by hand. Providers like Hostinger include free SSL and turn it on automatically, which removes most of the work in this guide. If valid at the time of purchase, new users may also be able to apply a coupon such as SPECIAL15 or SPECIAL10, subject to Hostinger's terms.
Affiliate disclosure: if you sign up through this link we may earn a commission, at no extra cost to you. How this works.
The editorial team behind the Bitrich777 Hosting Help Center — practical, tested guides on web hosting, WordPress, servers, DNS, SSL, email, security and migration. Every walkthrough is reproduced on a live host before it is published.
View all guides by the Hosting Team Spotted an error? Tell us
